Network monitoring can be used for many purposes, including analyzing network problems, detecting network intrusion attempts, gaining information for effecting a network intrusion, monitoring network usage, gathering and reporting network statistics, filtering suspect content from network traffic, reverse-engineering protocols used over a network, and debugging client/server communications.
Known network monitoring systems include packet “sniffers” (also known as network or protocol analyzers or Ethernet sniffers) which can intercept and log data packets passing over a digital network or part of a network, and can be set to capture or copy packets that are intended for a single machine on a network or, if set to “promiscuous mode”, a packet sniffer is also capable of capturing or copying all data packets traversing a network regardless of their intended destination.
A problem facing known network monitoring systems is that the volume of network traffic in local and wide area networks is increasing at a dramatic rate, due to increased sizes of networks combined with the requirement for networks to perform increasingly varied tasks, and increases in available bandwidth and speed of the networks. Hence known systems cannot process data packets at the rate at which they are transmitted and tend to store raw data as it passes the packet sniffer. The data is then processed at the best possible rate, and periods of low network use, such as at night, can be used to “catch up” with the data processing.
There are several disadvantages of processing the data at a slower speed than data is received. For example it is necessary to provide large data storage capacity for the raw data, it is not possible to catch up if the network is used at a high rate continuously, and also it is not possible to run any real-time dependent monitoring tasks.